Institut-du-Numerique-Responsable/perf-sentinel chart-v0.27.0

perf-sentinel chart v0.27.0

on GitHub

What's new in chart-v0.27.0

appVersion moves to 0.27.0 and image.tag follows it to :0.27.0. No template, values.yaml key or schema changes. Under the default values the rendered perf-sentinel.toml differs from what chart-v0.26.3 rendered by comments only, 5353 bytes against 5036: the configuration the daemon loads is the same. The other manifest changes are the image, the version labels and checksum/config.

What moves inside the pod

The daemon can now put every read of its query API behind a key. [daemon] require_read_key = true, set through config or fragments, makes every GET and HEAD under /api answer 401 unless the request carries [daemon] read_api_key (PERF_SENTINEL_READ_API_KEY) or the write key the route already accepts, as X-API-Key or Authorization: Bearer. It is off by default, so a release that does not set it behaves as before. /metrics, /health and OTLP ingest stay outside the gate, so probes, the ServiceMonitor and the collectors keep working.

The comments of the default config.toml and of the ingress block in values.yaml now describe the switch. The ingress comment no longer claims that every other read stays open, which is false once the switch is on.

The perf-sentinel CLI in the image gains login, logout and hub for PerfSentinelHub 0.4.0, and query --api-key-file on every subcommand. Its SARIF logs and the footer of its TUI point at the repository's new home.

The v0.27.0 binary notes describe the changes.

Upgrade impact

• Pods roll on the image. helm upgrade replaces them because appVersion and image.tag move together.
• Turning require_read_key on cuts off every reader without the key. The Hub source needs AuthHeaderName=X-API-Key and AuthHeaderValue=<read_api_key>, or it shows unreachable. Grafana datasources, perf-sentinel query, the live HTML report and the JetBrains plugin need it too, and earlier plugin releases send none. Behind an Ingress, every reader that goes through it needs the key as well.
• A daemon with the switch on but no read key, or with [daemon.cors] allowed_origins = ["*"], does not start. The config load fails and the pod stays in CrashLoopBackOff.
• checksum/config moves, and not because your configuration changed. The rendered perf-sentinel.toml differs by comments only, and the ConfigMap carries helm.sh/chart and app.kubernetes.io/version labels that bump with the chart.
• No values.yaml key is added or removed, no template changes, and the shipped PrometheusRule is untouched.

Verifying this chart

Charts signed before the move carry the original account's identity, so the regex accepts both owners:

cosign verify \
  --certificate-identity-regexp '^https://github.com/(robintra|Institut-du-Numerique-Responsable)/perf-sentinel/\.github/workflows/helm-release\.yml@refs/tags/chart-v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/institut-du-numerique-responsable/charts/perf-sentinel:0.27.0

helm pull oci://ghcr.io/institut-du-numerique-responsable/charts/perf-sentinel --version 0.27.0
gh attestation verify perf-sentinel-0.27.0.tgz \
  --repo Institut-du-Numerique-Responsable/perf-sentinel

cosign 3.0 or newer is required, the signature is an OCI 1.1 referrer bundle.

Install

The chart is published as an OCI artifact on GHCR, install it directly with no helm repo add step:

helm install perf-sentinel oci://ghcr.io/institut-du-numerique-responsable/charts/perf-sentinel --version 0.27.0

Upgrade an existing release:

helm upgrade perf-sentinel oci://ghcr.io/institut-du-numerique-responsable/charts/perf-sentinel --version 0.27.0

Read docs/HELM-DEPLOYMENT.md for the ServiceMonitor section, sizing and Ingress postures.

If you are upgrading from chart-v0.23.0 or earlier, read the chart-v0.24.0 notes first: that release raises the default workload.statefulset.persistence.size to 2Gi, which an existing StatefulSet does not pick up on its own. From chart-v0.18.0 or earlier, read the chart-v0.19.0 notes as well: that release adds a grouping label to five metrics and is breaking for an unaggregated alert on any of them. From chart-v0.16.0 or earlier, the chart-v0.17.0 notes change the shipped PrometheusRule.

Full Changelog: chart-v0.26.3...chart-v0.27.0